Behavioral task
behavioral1
Sample
f0615222efdb2699a7d869641bcf7eab.exe
Resource
win7-20231215-en
General
-
Target
f0615222efdb2699a7d869641bcf7eab.exe
-
Size
5.3MB
-
MD5
f0615222efdb2699a7d869641bcf7eab
-
SHA1
e346c26ede7d5e6e97bc5f9578a3c7dc5853e4af
-
SHA256
216af63fedbf9379d7d2f6b52eb81d3b19a1310fa0cb365a6121788b2b48baa0
-
SHA512
d0a817eeaa3ecd507e778fc1422a0989d116d0d635d976924681176e17e9d7a38f1d9963954def8892bf9483ba6de989595114e2da009281e2b2489796e34a16
-
SSDEEP
49152:+a2+8ZkbcfOPIMmuv2d2cWfGmsQZ0Wf8f8QlWuWzVjnbXGp8mih7NUfXUu4tEqN5:+aTX1HlUUdG/Mul2rq/aReDkizMeQUa
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule sample family_zgrat_v1 -
Zgrat family
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f0615222efdb2699a7d869641bcf7eab.exe
Files
-
f0615222efdb2699a7d869641bcf7eab.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 127KB - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ